CVE-2021-40129 Cisco Common Services Platform Collector SQL Injection Vulnerability

Medium 4.9 Published 18 Nov 2021 Updated 7 Nov 2024

Authenticated attackers can read restricted database information via SQL injection in the Cisco CSPC configuration dashboard.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-40129?

CVE-2021-40129 is a medium-severity SQL injection vulnerability in Cisco Common Services Platform Collector Software, published on 18 Nov 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to submit a SQL query through the CSPC configuration dashboard. This vulnerability is due to insufficient input validation of uploaded files. An attacker could exploit this vulnerability by uploading a file containing a SQL query to the configuration dashboard. A successful exploit could allow the attacker to read restricted information from the CSPC SQL database.

Weakness: CWE-89

Which versions are affected by CVE-2021-40129?

It affects 1 product.

Products include Cisco Common Services Platform Collector.

How do I fix CVE-2021-40129?

No fix has been published for CVE-2021-40129 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2021-40129 being exploited?

There is no known exploitation of CVE-2021-40129 in the wild and no public exploit code.

Sources

Also known as GHSA-rj68-45gv-f3rv.